🔍 Read the full analysis: What Black October 2026’S Record CVEs And Crypto Heist Mean For AI on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
October 2026 set a record for newly published CVE records, while CISA added 36 vulnerabilities to its exploited-flaws catalog. CertiK estimated $3.47 billion in crypto losses for the month, with the FBI attributing the Binance theft to North Korea. AI tools helped identify some flaws, but the figures do not show that AI caused the broader surge in disclosures or the largest theft.
October 2026 set records for published vulnerability records and reported cryptocurrency losses, while the number of newly listed actively exploited flaws rose more modestly, according to figures compiled by ThorstenMeyerAI.com. The same account documents AI-assisted vulnerability research and says the FBI attributed the October 29 Binance theft to North Korea, but it does not establish that AI caused either the month’s disclosure surge or the heist.
The report’s count of National Vulnerability Database (NVD) records published in October was 17,060, excluding rejected records. That compares with 4,273 in October 2025 and 3,564 in October 2024. From January through October, the count was 89,859 in 2026, compared with 39,639 in the same period of 2025. The author says the figures came from an NVD API query on November 1; including rejected records would raise October 2026’s count to 17,481.
A separate measure rose less sharply. The report says the Cybersecurity and Infrastructure Security Agency (CISA) added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, compared with 31 in October 2025 and 17 in October 2024. CISA’s catalog version dated October 30 showed 282 additions from January through October 2026, already above the 245 added during all of 2025. The two counts describe different things: published vulnerability records and flaws for which CISA has evidence of exploitation.
CertiK’s estimate, as reported by the source, put October crypto losses at $3.47 billion after frozen and returned funds, compared with $68 million in October 2025. Binance accounted for 96.7% of the October total. The FBI attributed the Binance theft to North Korea’s “TraderTraitor” on October 31. Separately, the account says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including a flaw already exploited in the wild.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosure Records Outpace Exploitation
The central distinction is between finding and publishing flaws and attackers actually using them. October’s CVE count was four times the count reported for October 2025, but CISA’s monthly additions to its exploited-vulnerability catalog rose from 31 to 36. That gap cautions against treating every new CVE as an active attack or as evidence that AI has made exploitation universal.
The source cites Google’s threat intelligence group as saying that exploitation has risen roughly in step with disclosure over a longer period, and that only about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. It also reports a moderate increase in average monthly zero-days, from eight to 11. These figures suggest serious risk, but they do not demonstrate that the disclosure surge itself produced a matching surge in attacks.
For organizations responsible for software and networks, the practical concern is prioritization: the report’s October KEV examples include remote-access gateways, firewalls, security appliances and widely used software. A growing disclosure pool can make it harder to identify what needs immediate attention. AI may help researchers find bugs and attackers adapt to fixes, but the source’s own examples support a mixed picture, not a single explanation for the month’s events.
Products Worth Considering
Dell 34-Inch S3425DW Curved WQHD USB-C Monitor
Dell 24 Plus Monitor S2425HSM – 23.8 FHD (1920×1080) 144Hz 1ms, 2 x 3W Speakers, HDMI, Height/Tilt/Pivot/Swivel Adjustability, AMD FreeSync
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
As an affiliate, we earn on qualifying purchases.
Three Measures, Different Signals
The source separates the month into three ledgers: disclosed flaws, documented exploitation and reported theft. A CVE is a public record of a vulnerability, not proof that it has been attacked. CISA’s KEV catalog is narrower, listing vulnerabilities for which the agency has reliable evidence of active exploitation. Crypto losses are a distinct measure, with totals that can change when funds are frozen or returned.
The CVE totals also depend on counting choices. The author excluded rejected NVD records and counted by publication date. The account says Google’s threat intelligence group warned that automated assignment policies can inflate totals; descriptions mentioning the Linux kernel alone generated about 5,000 CVEs from January through August 2026, with no observed zero-day exploitation in that group. The author also reports that October’s KEV additions included five older vulnerabilities, published between 2015 and 2023, for which new exploitation evidence had emerged.
On AI, the report points to PHP2Shell, a set of PHP flaws patched on October 21 and associated with OpenAI’s Patch the Planet program. It also says Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over a six-month period. These are examples of security research and fixes, not proof that AI accounts for the overall rise in CVE records.
“That is my view, not a measurement.”
— Thorsten Meyer, ThorstenMeyerAI.com
What the October Figures Cannot Show
The figures do not establish why NVD disclosures rose so sharply, how much of the increase reflects changes in reporting or assignment practices, or how many records correspond to flaws attackers could exploit in real conditions. The source itself notes that the disclosure total changes when rejected records are included. Its comparison between CVEs and KEV additions should not be read as a direct measure of the share of flaws exploited, because the catalogs use different criteria and timing.
The account says attackers can use AI to turn fixes into exploits within days and that the PHP2Shell embargo broke before release, but it provides no detailed incident evidence in the supplied material to quantify AI’s role in those events. It also says the Binance theft began with a compromised laptop rather than an AI-found bug; the source does not provide a technical investigation establishing the full attack chain. The FBI attribution is reported by the author, and further public details about the theft, the attribution and the status of affected funds are not included here.
CertiK’s loss estimate is reported after frozen and returned funds, but the source does not give a breakdown of the underlying incidents or explain how the total was calculated. The timing of recovery, the final amount retained by attackers and the extent of any AI involvement in the month’s attacks remain unclear.
Watch for Evidence Beyond Counts
The next useful indicators are updated NVD publication totals, CISA KEV additions and incident investigations that describe how attackers gained access. Those measures can show whether the October gap between disclosure and documented exploitation persists, while accounting for differences in how each database records vulnerabilities.
Further reporting on the Binance incident could clarify the FBI’s attribution, the alleged role of the compromised laptop and whether funds were recovered. Security advisories and post-incident analyses for PHP2Shell and other October vulnerabilities may also show how quickly exploitation followed disclosure and whether AI tools played a documented role. Until then, October’s records establish a sharp rise in published flaws and crypto losses, but not a single AI-driven cause.
Key Questions
How many CVE records were published in October 2026?
ThorstenMeyerAI.com counted 17,060 NVD records published in October, excluding rejected records. The count was 17,481 when rejected records were included, according to the source.
Did the number of exploited vulnerabilities rise as much as CVE disclosures?
No. The source reports 36 October additions to CISA’s Known Exploited Vulnerabilities catalog, up from 31 in October 2025, while the NVD record count rose from 4,273 to 17,060. These are separate measures and should not be treated as directly equivalent.
Did AI cause the October vulnerability surge or Binance theft?
The supplied report does not establish that. It documents AI-assisted vulnerability research and says the FBI attributed the Binance theft to North Korea, but it does not link AI to the disclosure surge or establish AI’s role in the theft.
What was the reported scale of October’s crypto losses?
CertiK estimated $3.47 billion in losses after frozen and returned funds, with Binance accounting for 96.7% of the monthly total, according to the source. The supplied material does not provide a full incident-by-incident breakdown.
Source: ThorstenMeyerAI.com
